The latest entry on Scarlettgroup’s victim list is a Toronto hospital that treats the province’s most severe trauma cases. The group posted Sunnybrook Health Sciences Centre on its data leak site on October 29, 2026, adopting the hospital’s own public description of its trauma, cancer, cardiac and rehabilitation programs.
No file inventory, data volume or sample documents have been published alongside the claim, and Sunnybrook has not confirmed an intrusion.
A crew with almost no track record
Ransomware.live counts eight victims for Scarlettgroup since the group first appeared on October 8, with an estimated attack date of October 5 on its earliest claim. Its prior targets were financial, hospitality, government and technology organizations in India, Malaysia and the United States, plus one education victim. Its leaks go to the QU.AX service.
That inexperience matters. A month-old operation can be a genuine RaaS splinter or a repackaging of stolen access data, and the tracker itself advises treating claims as unverified until independently corroborated. Healthcare listings from unproven groups sometimes turn out to be recycled extortion attempts rather than actual intrusions.
What hospital security teams should do
Sunnybrook’s profile, a teaching and research hospital with regional trauma designation, makes it a high-value target regardless of whether this particular claim holds. Canadian providers should assume leak-site naming is a disclosure event of its own: monitor for the brand, confirm externally reachable services, and log outbound data volume from clinical repositories so a real exfiltration can be distinguished from a bluff.
For the sector, the takeaway is that new gangs now arrive targeting hospitals within weeks of forming.
